551 lines
17 KiB
Groff
551 lines
17 KiB
Groff
.rn '' }`
|
|
''' $RCSfile$$Revision$$Date$
|
|
'''
|
|
''' $Log$
|
|
''' Revision 1.10 1999/06/22 10:38:38 millert
|
|
''' typos
|
|
'''
|
|
'''
|
|
.de Sh
|
|
.br
|
|
.if t .Sp
|
|
.ne 5
|
|
.PP
|
|
\fB\\$1\fR
|
|
.PP
|
|
..
|
|
.de Sp
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Ip
|
|
.br
|
|
.ie \\n(.$>=3 .ne \\$3
|
|
.el .ne 3
|
|
.IP "\\$1" \\$2
|
|
..
|
|
.de Vb
|
|
.ft CW
|
|
.nf
|
|
.ne \\$1
|
|
..
|
|
.de Ve
|
|
.ft R
|
|
|
|
.fi
|
|
..
|
|
'''
|
|
'''
|
|
''' Set up \*(-- to give an unbreakable dash;
|
|
''' string Tr holds user defined translation string.
|
|
''' Bell System Logo is used as a dummy character.
|
|
'''
|
|
.tr \(*W-|\(bv\*(Tr
|
|
.ie n \{\
|
|
.ds -- \(*W-
|
|
.ds PI pi
|
|
.if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
|
.if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
|
.ds L" ""
|
|
.ds R" ""
|
|
''' \*(M", \*(S", \*(N" and \*(T" are the equivalent of
|
|
''' \*(L" and \*(R", except that they are used on ".xx" lines,
|
|
''' such as .IP and .SH, which do another additional levels of
|
|
''' double-quote interpretation
|
|
.ds M" """
|
|
.ds S" """
|
|
.ds N" """""
|
|
.ds T" """""
|
|
.ds L' '
|
|
.ds R' '
|
|
.ds M' '
|
|
.ds S' '
|
|
.ds N' '
|
|
.ds T' '
|
|
'br\}
|
|
.el\{\
|
|
.ds -- \(em\|
|
|
.tr \*(Tr
|
|
.ds L" ``
|
|
.ds R" ''
|
|
.ds M" ``
|
|
.ds S" ''
|
|
.ds N" ``
|
|
.ds T" ''
|
|
.ds L' `
|
|
.ds R' '
|
|
.ds M' `
|
|
.ds S' '
|
|
.ds N' `
|
|
.ds T' '
|
|
.ds PI \(*p
|
|
'br\}
|
|
.\" If the F register is turned on, we'll generate
|
|
.\" index entries out stderr for the following things:
|
|
.\" TH Title
|
|
.\" SH Header
|
|
.\" Sh Subsection
|
|
.\" Ip Item
|
|
.\" X<> Xref (embedded
|
|
.\" Of course, you have to process the output yourself
|
|
.\" in some meaninful fashion.
|
|
.if \nF \{
|
|
.de IX
|
|
.tm Index:\\$1\t\\n%\t"\\$2"
|
|
..
|
|
.nr % 0
|
|
.rr F
|
|
.\}
|
|
.TH sudoers 5 "1.6" "22/Jun/1999" "FILE FORMATS"
|
|
.UC
|
|
.if n .hy 0
|
|
.if n .na
|
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
|
.de CQ \" put $1 in typewriter font
|
|
.ft CW
|
|
'if n "\c
|
|
'if t \\&\\$1\c
|
|
'if n \\&\\$1\c
|
|
'if n \&"
|
|
\\&\\$2 \\$3 \\$4 \\$5 \\$6 \\$7
|
|
'.ft R
|
|
..
|
|
.\" @(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2
|
|
. \" AM - accent mark definitions
|
|
.bd B 3
|
|
. \" fudge factors for nroff and troff
|
|
.if n \{\
|
|
. ds #H 0
|
|
. ds #V .8m
|
|
. ds #F .3m
|
|
. ds #[ \f1
|
|
. ds #] \fP
|
|
.\}
|
|
.if t \{\
|
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
|
. ds #V .6m
|
|
. ds #F 0
|
|
. ds #[ \&
|
|
. ds #] \&
|
|
.\}
|
|
. \" simple accents for nroff and troff
|
|
.if n \{\
|
|
. ds ' \&
|
|
. ds ` \&
|
|
. ds ^ \&
|
|
. ds , \&
|
|
. ds ~ ~
|
|
. ds ? ?
|
|
. ds ! !
|
|
. ds /
|
|
. ds q
|
|
.\}
|
|
.if t \{\
|
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
|
. ds ? \s-2c\h'-\w'c'u*7/10'\u\h'\*(#H'\zi\d\s+2\h'\w'c'u*8/10'
|
|
. ds ! \s-2\(or\s+2\h'-\w'\(or'u'\v'-.8m'.\v'.8m'
|
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
|
. ds q o\h'-\w'o'u*8/10'\s-4\v'.4m'\z\(*i\v'-.4m'\s+4\h'\w'o'u*8/10'
|
|
.\}
|
|
. \" troff and (daisy-wheel) nroff accents
|
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
|
.ds v \\k:\h'-(\\n(.wu*9/10-\*(#H)'\v'-\*(#V'\*(#[\s-4v\s0\v'\*(#V'\h'|\\n:u'\*(#]
|
|
.ds _ \\k:\h'-(\\n(.wu*9/10-\*(#H+(\*(#F*2/3))'\v'-.4m'\z\(hy\v'.4m'\h'|\\n:u'
|
|
.ds . \\k:\h'-(\\n(.wu*8/10)'\v'\*(#V*4/10'\z.\v'-\*(#V*4/10'\h'|\\n:u'
|
|
.ds 3 \*(#[\v'.2m'\s-2\&3\s0\v'-.2m'\*(#]
|
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
|
.ds oe o\h'-(\w'o'u*4/10)'e
|
|
.ds Oe O\h'-(\w'O'u*4/10)'E
|
|
. \" corrections for vroff
|
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
|
. \" for low resolution devices (crt and lpr)
|
|
.if \n(.H>23 .if \n(.V>19 \
|
|
\{\
|
|
. ds : e
|
|
. ds 8 ss
|
|
. ds v \h'-1'\o'\(aa\(ga'
|
|
. ds _ \h'-1'^
|
|
. ds . \h'-1'.
|
|
. ds 3 3
|
|
. ds o a
|
|
. ds d- d\h'-1'\(ga
|
|
. ds D- D\h'-1'\(hy
|
|
. ds th \o'bp'
|
|
. ds Th \o'LP'
|
|
. ds ae ae
|
|
. ds Ae AE
|
|
. ds oe oe
|
|
. ds Oe OE
|
|
.\}
|
|
.rm #[ #] #H #V #F C
|
|
.SH "NAME"
|
|
sudoers \- list of which users may execute what as root
|
|
.SH "DESCRIPTION"
|
|
The \fIsudoers\fR file is composed of an optional host alias section,
|
|
an optional command alias section and the user specification section.
|
|
All command or host aliases need to start with their respective keywords
|
|
(ie: Host_Alias, User_Alias, Runas_Alias or Cmnd_Alias).
|
|
If there are multiple occurrences of a user, the logical union of the
|
|
entries will be used. Note that if there is an entry that denies access
|
|
to a command that is followed by an entry that grants access the user
|
|
will be allowed to run the command.
|
|
.Sh "user specification format:"
|
|
.PP
|
|
.Vb 1
|
|
\& user access_group [: access_group] ...
|
|
.Ve
|
|
.Vb 4
|
|
\& access_group ::= host-list = [(runas-list)] [NOPASSWD:] [op]cmnd_type
|
|
\& [,[(user-list)] [NOPASSWD|PASSWD:] [op]cmnd_type] ...
|
|
\& cmnd_type ::= a command OR a command alias.
|
|
\& op ::= the logical "!" NOT operator.
|
|
.Ve
|
|
.Sh "host alias section format:"
|
|
.PP
|
|
.Vb 1
|
|
\& Host_Alias HOSTALIAS = host-list
|
|
.Ve
|
|
.Vb 5
|
|
\& Host_Alias ::= a keyword.
|
|
\& HOSTALIAS ::= an upper-case alias name.
|
|
\& host-list ::= a comma separated list of hosts, netgroups,
|
|
\& ip addresses, networks. A logical "!"
|
|
\& NOT operator may be prefixed to any of these.
|
|
.Ve
|
|
.Sh "user alias section format:"
|
|
.PP
|
|
.Vb 1
|
|
\& User_Alias USERALIAS = user-list
|
|
.Ve
|
|
.Vb 5
|
|
\& User_Alias ::= a keyword.
|
|
\& USERALIAS ::= an upper-case alias name.
|
|
\& user-list ::= a comma separated list of users, groups, netgroups.
|
|
\& A logical "!" NOT operator may be prefixed to any
|
|
\& of these.
|
|
.Ve
|
|
.Sh "runas alias section format:"
|
|
.PP
|
|
.Vb 1
|
|
\& Runas_Alias RUNASALIAS = runas-list
|
|
.Ve
|
|
.Vb 5
|
|
\& Runas_Alias ::= a keyword.
|
|
\& RUNASALIAS ::= an upper-case alias name.
|
|
\& runas-list ::= a comma separated list of users, groups, netgroups.
|
|
\& A logical "!" NOT operator may be prefixed to any
|
|
\& of these.
|
|
.Ve
|
|
.Sh "command alias section format:"
|
|
.PP
|
|
.Vb 1
|
|
\& Cmnd_Alias CMNDALIAS = cmnd-list
|
|
.Ve
|
|
.Vb 5
|
|
\& Cmnd_Alias ::= a keyword.
|
|
\& CMNDALIAS ::= an upper-case alias name.
|
|
\& cmnd-list ::= a comma separated list commands.
|
|
\& A logical "!" NOT operator may be prefixed to any
|
|
\& of these.
|
|
.Ve
|
|
.Sh "command specification:"
|
|
.PP
|
|
.Vb 1
|
|
\& path arg1 arg2 .. argn = command
|
|
.Ve
|
|
.Vb 2
|
|
\& path ::= a fully qualified pathname.
|
|
\& arg[1..n] ::= optional command line arguments.
|
|
.Ve
|
|
.Sh "persistence of modifiers"
|
|
When a \fIrunas-list\fR is specified for an \fIaccess_group\fR, it
|
|
affects all commands in the \fIaccess_group\fR. For example, given:
|
|
.PP
|
|
.Vb 1
|
|
\& oper bigserver = (root, sysadm) /usr/bin/kill, /bin/rm
|
|
.Ve
|
|
User \f(CWoper\fR will be able to run \f(CW/usr/bin/kill\fR and \f(CW/bin/rm\fR
|
|
as \fBroot\fR or \fBsysadm\fR on the machine, \f(CWbigserver\fR. The
|
|
\fIrunas-list\fR is \*(L"sticky\*(R" across entries in the comma-separated
|
|
\fIaccess_group\fR. You can override the \fIrunas-list\fR with another
|
|
one, at which point the new \fIrunas-list\fR becomes the default for
|
|
that \fIaccess_group\fR. For example, given:
|
|
.PP
|
|
.Vb 2
|
|
\& oper bigserver = (root, sysadm) /usr/bin/kill, (root) /bin/rm, \e
|
|
\& /bin/rmdir
|
|
.Ve
|
|
User \f(CWoper\fR can still run \f(CW/usr/bin/kill\fR as \fBroot\fR or \fBsysadm\fR but
|
|
can only run \f(CW/bin/rm\fR and \f(CW/bin/rmdir\fR as \fBroot\fR.
|
|
.PP
|
|
Similarly, the \fB\s-1NOPASSWD\s0\fR modifier is also persistent across an
|
|
\fIaccess_group\fR. For example given:
|
|
.PP
|
|
.Vb 1
|
|
\& oper bigserver = NOPASSWD: /usr/bin/kill, /bin/rm, /bin/rmdir
|
|
.Ve
|
|
User \f(CWoper\fR will be able to run \f(CW/usr/bin/kill\fR, \f(CW/bin/rm\fR, and
|
|
\f(CW/bin/rmdir\fR as \fBroot\fR without a password. If we change that to:
|
|
.PP
|
|
.Vb 1
|
|
\& oper bigserver = NOPASSWD: /usr/bin/kill, PASSWD: /bin/rm, /bin/rmdir
|
|
.Ve
|
|
User \f(CWoper\fR can still run \f(CW/usr/bin/kill\fR without a password but
|
|
must give a password to run \f(CW/bin/rm\fR and \f(CW/bin/rmdir\fR.
|
|
.Sh "wildcards (aka meta characters):"
|
|
\fBsudo\fR allows shell-style \fIwildcards\fR along with command arguments
|
|
in the \fIsudoers\fR file. Wildcard matching is done via the \fB\s-1POSIX\s0\fR
|
|
\f(CWfnmatch(3)\fR routine.
|
|
.Ip "\f(CW*\fR" 8
|
|
Matches any set of zero or more characters.
|
|
.Ip "\f(CW?\fR" 8
|
|
Matches any single character.
|
|
.Ip "\f(CW[...]\fR" 8
|
|
Matches any character in the specified range.
|
|
.Ip "\f(CW[!...]\fR" 8
|
|
Matches any character \fBnot\fR in the specified range.
|
|
.Ip "\f(CW\ex\fR" 8
|
|
For any character \*(L"x\*(R", evaluates to \*(L"x\*(R". This is used to
|
|
escape special characters such as: \*(L"*\*(R", \*(L"?\*(R", \*(L"[\*(R", and \*(L"}\*(R".
|
|
.Sh "exceptions to wildcard rules:"
|
|
The following exceptions apply to the above rules:
|
|
.Ip "\f(CW""\fR" 8
|
|
If the empty string \f(CW""\fR is the only command line argument in the
|
|
\fIsudoers\fR entry it means that command may take \fBno\fR arguments.
|
|
.Sh "other special characters and reserved words:"
|
|
Text after a pound sign (\fB#\fR) is considered a comment.
|
|
Words that begin with a percent sign (\fB%\fR) are assumed to
|
|
be \s-1UN\s0*X groups (%staff refers to users in the group \fIstaff\fR).
|
|
Words that begin with a plus sign (\fB+\fR) are assumed to
|
|
be netgroups (\fB+cshosts\fR refers to the netgroup \fIcshosts\fR).
|
|
Long lines can be newline escaped with the backslash \fB\e\fR character.
|
|
.PP
|
|
The reserved word \fB\s-1NOPASSWD\s0\fR indicates that a user need not
|
|
enter a password for the command listed in that entry. The
|
|
\fB\s-1NOPASSWD\s0\fR modifier is persistent across entries in a \fIuser-list\fR
|
|
and can be reversed with the \fB\s-1PASSWD\s0\fR modifier.
|
|
.PP
|
|
The reserved alias \fI\s-1ALL\s0\fR can be used for both {Host,User,Cmnd}_Alias.
|
|
\fB\s-1DO\s0 \s-1NOT\s0\fR define an alias of \fI\s-1ALL\s0\fR, it will \fB\s-1NOT\s0\fR be used.
|
|
Note that \fI\s-1ALL\s0\fR implies the entire universe of hosts/users/commands.
|
|
You can subtract elements from the universe by using the syntax:
|
|
.PP
|
|
.Vb 1
|
|
\& user host=ALL,!ALIAS1,!/sbin/halt...
|
|
.Ve
|
|
Commands may have optional command line arguments. If they do,
|
|
then the arguments in the \fIsudoers\fR file must exactly match those
|
|
on the command line. It is also possible to have a command's
|
|
arguments span multiple lines as long as the line continuance
|
|
character \*(L"\e\*(R" is used. The following characters must be escaped
|
|
with a \*(L"\e\*(R" if used in command arguments: \*(L",\*(R", \*(L":\*(R", \*(L"=\*(R", \*(L"\e\*(R".
|
|
.SH "EXAMPLES"
|
|
.PP
|
|
.Vb 7
|
|
\& # Host alias specification
|
|
\& Host_Alias HUB=houdini:\e
|
|
\& REMOTE=merlin,kodiakthorn,spirit
|
|
\& Host_Alias SERVERS=houdini,merlin,kodiakthorn,spirit
|
|
\& Host_Alias CUNETS=128.138.0.0/255.255.0.0
|
|
\& Host_Alias CSNETS=128.138.243.0,128.138.204.0,\e
|
|
\& 128.138.205.192
|
|
.Ve
|
|
.Vb 3
|
|
\& # User alias specification
|
|
\& User_Alias FULLTIME=millert,dowdy,mikef
|
|
\& User_Alias PARTTIME=juola,mccreary,tor
|
|
.Ve
|
|
.Vb 2
|
|
\& # Runas alias specification
|
|
\& Runas_Alias OP=root,operator
|
|
.Ve
|
|
.Vb 6
|
|
\& # Command alias specification
|
|
\& Cmnd_Alias LPCS=/usr/sbin/lpc,/usr/bin/lprm
|
|
\& Cmnd_Alias SHELLS=/bin/sh,/bin/csh,/bin/tcsh,/bin/ksh
|
|
\& Cmnd_Alias SU=/usr/bin/su
|
|
\& Cmnd_Alias MISC=/bin/rm,/bin/cat:\e
|
|
\& SHUTDOWN=/sbin/halt,/sbin/shutdown
|
|
.Ve
|
|
.Vb 14
|
|
\& # User specification
|
|
\& FULLTIME ALL=(ALL) NOPASSWD: ALL
|
|
\& %wheel ALL=ALL
|
|
\& PARTTIME ALL=ALL,!SHELLS,!SU
|
|
\& +interns +openlabs=ALL,!SHELLS,!SU
|
|
\& britt REMOTE=SHUTDOWN:ALL=LPCS
|
|
\& jimbo CUNETS=/usr/bin/su [!-]*,!/usr/bin/su *root*
|
|
\& nieusma SERVERS=SHUTDOWN,/sbin/reboot:\e
|
|
\& HUB=ALL,!SHELLS
|
|
\& jill houdini=/sbin/shutdown -[hr] now,MISC
|
|
\& markm HUB=ALL,!MISC,!/sbin/shutdown,!/sbin/halt
|
|
\& davehieb merlin=(OP) ALL:SERVERS=/sbin/halt:\e
|
|
\& kodiakthorn=NOPASSWD: ALL
|
|
\& steve CSNETS=(operator) /usr/op_commands/
|
|
.Ve
|
|
.Sh "Host Alias specifications:"
|
|
The are four \fIhost aliases\fR. The first actually contains
|
|
two \fIaliases\fR. It sets \f(CWHUB\fR to be \f(CWhoudini\fR and \f(CWREMOTE\fR
|
|
to the three machines \f(CWmerlin\fR, \f(CWkodiakthorn\fR and \f(CWspirit\fR.
|
|
Similarly, \f(CWSERVERS\fR is set to the machines \f(CWhoudini\fR, \f(CWmerlin\fR,
|
|
\f(CWkodiakthorn\fR and \f(CWspirit\fR. The \f(CWCSNETS\fR alias will match
|
|
any host on the 128.138.243.0, 128.138.204.0, or 128.138.205.192
|
|
nets. The \f(CWCUNETS\fR alias will match any host on the 128.138.0.0
|
|
(class B) network. Note that these are \fBnetwork\fR addresses, not ip
|
|
addresses. Unless an explicit netmask is given, the local \fInetmask\fR
|
|
is used to determine whether or not the current host belongs to a network.
|
|
.Sh "User Alias specifications:"
|
|
The two \fIuser aliases\fR simply groups the \f(CWFULLTIME\fR and
|
|
\f(CWPARTTIME\fR folks into two separate aliases.
|
|
.Sh "Command alias specifications:"
|
|
Command aliases are lists of commands with or without associated
|
|
command line arguments. The entries above should be self-explanatory.
|
|
.Sh "User specifications:"
|
|
.Ip "\s-1FULLTIME\s0" 16
|
|
Full-time sysadmins in the \f(CWFULLTIME\fR alias may run any
|
|
command on any host as any user without a password.
|
|
.Ip "%wheel" 16
|
|
Any user in the \s-1UN\s0*X group \f(CWwheel\fR may run any
|
|
command on any host.
|
|
.Ip "\s-1PARTTIME\s0" 16
|
|
Part-time sysadmins in the \f(CWPARTTIME\fR alias may run any
|
|
command except those in the \f(CWSHELLS\fR and \f(CWSU\fR aliases
|
|
on any host.
|
|
.Ip "+interns" 16
|
|
Any user in the netgroup \f(CWinterns\fR may run any
|
|
command except those in the \f(CWSHELLS\fR and \f(CWSU\fR aliases
|
|
on any host that is in the \f(CWopenlabs\fR netgroup.
|
|
.Ip "britt" 16
|
|
The user \f(CWbritt\fR may run commands in the \f(CWSHUTDOWN\fR alias
|
|
on the \f(CWREMOTE\fR machines and commands in the \f(CWLPCS\fR alias
|
|
on any machine.
|
|
.Ip "jimbo" 16
|
|
The user \f(CWjimbo\fR may \f(CWsu\fR to any user save root on the
|
|
machines on \f(CWCUNETS\fR (which is explicitly listed as a class
|
|
B network).
|
|
.Ip "nieusma" 16
|
|
The user \f(CWnieusma\fR may run commands in the \f(CWSHUTDOWN\fR alias
|
|
as well as \fI/sbin/reboot\fR on the \f(CWSERVER\fR machines and
|
|
any command except those in the \f(CWSHELLS\fR alias on the \f(CWHUB\fR
|
|
machines.
|
|
.Ip "jill" 16
|
|
The user \f(CWjill\fR may run \f(CW/sbin/shutdown -h now\fR or
|
|
\f(CW/sbin/shutdown -r now\fR as well as the commands in the
|
|
\f(CWMISC\fR alias on houdini.
|
|
.Ip "markm" 16
|
|
The user \f(CWmarkm\fR may run any command on the \f(CWHUB\fR machines
|
|
except \fI/sbin/shutdown\fR, \fI/sbin/halt\fR, and commands listed
|
|
in the \f(CWMISC\fR alias.
|
|
.Ip "davehieb" 16
|
|
The user \f(CWdavehieb\fR may run any command on \f(CWmerlin\fR as any
|
|
user in the Runas_Alias \s-1OP\s0 (ie: root or operator). He may
|
|
also run \fI/sbin/halt\fR on the \f(CWSERVERS\fR and any command
|
|
on \f(CWkodiakthorn\fR (no password required on \f(CWkodiakthorn\fR).
|
|
.Ip "steve" 16
|
|
The user \f(CWsteve\fR may run any command in the \fI/usr/op_commands/\fR
|
|
directory as user \f(CWoperator\fR on the machines on \f(CWCSNETS\fR.
|
|
.SH "CAVEATS"
|
|
The \fIsudoers\fR file should \fBalways\fR be edited by the \fBvisudo\fR
|
|
command which locks the file and does grammatical checking. It is
|
|
imperative that the \fIsudoers\fR be free of syntax errors since sudo
|
|
will not run with a syntactically incorrect \fIsudoers\fR file.
|
|
.SH "FILES"
|
|
.PP
|
|
.Vb 2
|
|
\& /etc/sudoers file of authorized users.
|
|
\& /etc/netgroup list of network groups.
|
|
.Ve
|
|
.SH "SEE ALSO"
|
|
\fIsudo\fR\|(8), \fIvisudo\fR\|(8), \fIsu\fR\|(1), \fIfnmatch\fR\|(3).
|
|
|
|
.rn }` ''
|
|
.IX Title "sudoers 5"
|
|
.IX Name "sudoers - list of which users may execute what as root"
|
|
|
|
.IX Header "NAME"
|
|
|
|
.IX Header "DESCRIPTION"
|
|
|
|
.IX Subsection "user specification format:"
|
|
|
|
.IX Subsection "host alias section format:"
|
|
|
|
.IX Subsection "user alias section format:"
|
|
|
|
.IX Subsection "runas alias section format:"
|
|
|
|
.IX Subsection "command alias section format:"
|
|
|
|
.IX Subsection "command specification:"
|
|
|
|
.IX Subsection "persistence of modifiers"
|
|
|
|
.IX Subsection "wildcards (aka meta characters):"
|
|
|
|
.IX Item "\f(CW*\fR"
|
|
|
|
.IX Item "\f(CW?\fR"
|
|
|
|
.IX Item "\f(CW[...]\fR"
|
|
|
|
.IX Item "\f(CW[!...]\fR"
|
|
|
|
.IX Item "\f(CW\ex\fR"
|
|
|
|
.IX Subsection "exceptions to wildcard rules:"
|
|
|
|
.IX Item "\f(CW""\fR"
|
|
|
|
.IX Subsection "other special characters and reserved words:"
|
|
|
|
.IX Header "EXAMPLES"
|
|
|
|
.IX Subsection "Host Alias specifications:"
|
|
|
|
.IX Subsection "User Alias specifications:"
|
|
|
|
.IX Subsection "Command alias specifications:"
|
|
|
|
.IX Subsection "User specifications:"
|
|
|
|
.IX Item "\s-1FULLTIME\s0"
|
|
|
|
.IX Item "%wheel"
|
|
|
|
.IX Item "\s-1PARTTIME\s0"
|
|
|
|
.IX Item "+interns"
|
|
|
|
.IX Item "britt"
|
|
|
|
.IX Item "jimbo"
|
|
|
|
.IX Item "nieusma"
|
|
|
|
.IX Item "jill"
|
|
|
|
.IX Item "markm"
|
|
|
|
.IX Item "davehieb"
|
|
|
|
.IX Item "steve"
|
|
|
|
.IX Header "CAVEATS"
|
|
|
|
.IX Header "FILES"
|
|
|
|
.IX Header "SEE ALSO"
|
|
|